Hazy Scorpius has compromised more than 40 engineering organizations through an unauthenticated RCE in PTC Windchill, and the ...

Static application security testing, or SAST, is most useful when it is close to the way your team actually writes code. That is where Semgrep becomes valuable. It can scan source code quickly, fit ...

Amazon recently announced Kiro Crew, an open-source system for running multiple Kiro coding agents across sessions, tools, ...

Fabiane Nardon shares how TOTVS prepares enterprise data for token-hungry AI agents. She discusses balancing deterministic ...

The Windchill campaign shows how a trusted enterprise app can conceal data theft, credential access, and persistent control.

A newly disclosed Apache Log4j2 issue could allow attackers to bypass a deserialization allowlist and execute code remotely ...

The Gradle project is launching Agentic Gradle to make its build system easier for AI coding agents to use through official skills, benchmarks, and potential changes to Gradle itself.

Professor Rajesh Kumar and his research students are analyzing not only what students submit but also how they produce their ...

TL;DR A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control ...

Startups:  CleanStart co-founder Vijendra Katiyar explains why open source, AI-assisted coding and complex software ...

Spring updates patch 91 vulnerabilities, bringing the total count to over 200 in 2026, a surge powered by Broadcom’s use of ...

Ox Alpha, an anonymous AI coding model with 1M-token context, launched free on OpenRouter August 20 -- retaining every ...